As the ultimate authority in credentialing/privileging decisions, what must the hospital's governing body do to satisfy its legal mandate?